5.2 Use LockOut Realms

Information

A LockOut realm wraps around standard realms adding the ability to lock a user out after multiple failed logins.

Rationale:

Locking out a user after multiple failed logins slows down attackers from brute forcing logins.

Solution

Create a lockout realm wrapping the main realm similar to the example below:

<Realm className='org.apache.catalina.realm.LockOutRealm'
failureCount='3' lockOutTime='600' cacheSize='1000'
cacheRemovalWarningTime='3600'>
<Realm
className='org.apache.catalina.realm.DataSourceRealm'
dataSourceName=... />
</Realm>

See Also

https://workbench.cisecurity.org/files/4107

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: Unix

Control ID: 043d8a136a07ff2fe2e8788a37893d708162ef162cdf37580e864425f610b696